# vulnz: Vulnerability monitoring for WordPress professionals

> Monitor WordPress websites with a super\-lightweight agent plugin, and powerful zero\-click reporting\. Freelancers, agencies and WP hosters\.

Generated by Yoast SEO v28.1, this is an llms.txt file, meant for consumption by LLMs.

## Pages
- [Price plans](https://vulnz.net/pricing/)
- [Front page](https://vulnz.net/)
- [Vulnz Agent](https://vulnz.net/vulnz-wordpress-plugin/)
- [Vulnerability Writeups](https://vulnz.net/vulnerability-writeups/)
- [Search](https://vulnz.net/search/)

## Posts
- [Stored XSS in ManageWP Worker](https://vulnz.net/vulnerability-writeups/managewp-worker-2026-06-29/): ManageWP Worker versions prior to 4\.9\.32 contain a stored XSS vulnerability in the brand customisation feature, allowing an attacker with ManageWP account access to inject JavaScript into the WordPress admin dashboard\.
- [Stored XSS in All\-in\-One WP Security \& Firewall](https://vulnz.net/vulnerability-writeups/all-in-one-wp-security-firewall-2026-06-21/): CVE\-2026\-8438: All\-in\-One WP Security \& Firewall ≤5\.4\.7 allows unauthenticated attackers to inject persistent JavaScript via unsanitised input, executing in visitors' browsers across the site\.
- [Remote Code Execution in RD Station Plugin](https://vulnz.net/vulnerability-writeups/rd-station-2026-06-21/): CVE\-2026\-49774: RD Station Plugin ≤5\.6\.0 lets contributor\-level users execute arbitrary PHP by injecting a path traversal sequence into the OAuth refresh token, which is used unsanitised in a log file path\.
- [Booking Manipulation in WP Travel Engine](https://vulnz.net/vulnerability-writeups/wp-travel-engine-2026-06-22/): CVE\-2026\-49078: WP Travel Engine ≤6\.7\.10 lets unauthenticated attackers create fraudulent bookings and access customer data via AJAX endpoints with non\-fatal nonce validation\.
- [Information Disclosure in Advanced Custom Fields](https://vulnz.net/vulnerability-writeups/advanced-custom-fields-2026-04-16/): CVE\-2026\-4812: ACF 6\.7\.0 and earlier let unauthenticated attackers leak internal post, user, and relationship data by manipulating AJAX query parameters\.

## Optional
- [Sitemap index](https://vulnz.net/sitemap_index.xml)